From d3edaa91d4cf7202ec14342410194841e2f67f12 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Fri, 26 Feb 2021 11:30:32 +1030
Subject: [PATCH] Reinstate various pieces backed out from smart_rename changes

In the interests of a stable release various last minute smart_rename
patches were backed out of the 2.36 branch.  The main reason to
reinstate some of those backed out changes here is to make necessary
followup fixes to commit 8e03235147a9 simple cherry-picks from
mainline.  A secondary reason is that ar -M support isn't fixed for
pr26945 without this patch.

	PR 26945
	* ar.c: Don't include libbfd.h.
	(write_archive): Replace xmalloc+strcpy with xstrdup.
	* arsup.c (temp_name, real_ofd): New static variables.
	(ar_open): Use make_tempname and bfd_fdopenw.
	(ar_save): Adjust to suit ar_open changes.
	* objcopy.c: Don't include libbfd.h.
	* rename.c: Rename and reorder variables.

(cherry picked from commit 95b91a043aeaeb546d2fea556d84a2de1e917770)

Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d3edaa91d4cf7202ec14342410194841e2f67f12]
CVE: CVE-2021-20197
Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com>
---
 binutils/ar.c      |  4 +---
 binutils/arsup.c   | 37 +++++++++++++++++++++++++------------
 binutils/objcopy.c |  1 -
 binutils/rename.c  |  6 +++---
 5 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/binutils/ar.c b/binutils/ar.c
index 3a91708b51c..44df48c5c67 100644
--- a/binutils/ar.c
+++ b/binutils/ar.c
@@ -25,7 +25,6 @@
 
 #include "sysdep.h"
 #include "bfd.h"
-#include "libbfd.h"
 #include "libiberty.h"
 #include "progress.h"
 #include "getopt.h"
@@ -1255,8 +1254,7 @@ write_archive (bfd *iarch)
   bfd *contents_head = iarch->archive_next;
   int ofd = -1;
 
-  old_name = (char *) xmalloc (strlen (bfd_get_filename (iarch)) + 1);
-  strcpy (old_name, bfd_get_filename (iarch));
+  old_name = xstrdup (bfd_get_filename (iarch));
   new_name = make_tempname (old_name, &ofd);
 
   if (new_name == NULL)
diff --git a/binutils/arsup.c b/binutils/arsup.c
index 0a1f63f6456..f7ce8f0bc82 100644
--- a/binutils/arsup.c
+++ b/binutils/arsup.c
@@ -42,6 +42,8 @@ extern int deterministic;
 
 static bfd *obfd;
 static char *real_name;
+static char *temp_name;
+static int real_ofd;
 static FILE *outfile;
 
 static void
@@ -149,27 +151,24 @@ maybequit (void)
 void
 ar_open (char *name, int t)
 {
-  char *tname;
-  const char *bname = lbasename (name);
-  real_name = name;
+  real_name = xstrdup (name);
+  temp_name = make_tempname (real_name, &real_ofd);
 
-  /* Prepend tmp- to the beginning, to avoid file-name clashes after
-     truncation on filesystems with limited namespaces (DOS).  */
-  if (asprintf (&tname, "%.*stmp-%s", (int) (bname - name), name, bname) == -1)
+  if (temp_name == NULL)
     {
-      fprintf (stderr, _("%s: Can't allocate memory for temp name (%s)\n"),
+      fprintf (stderr, _("%s: Can't open temporary file (%s)\n"),
 	       program_name, strerror(errno));
       maybequit ();
       return;
     }
 
-  obfd = bfd_openw (tname, NULL);
+  obfd = bfd_fdopenw (temp_name, NULL, real_ofd);
 
   if (!obfd)
     {
       fprintf (stderr,
 	       _("%s: Can't open output archive %s\n"),
-	       program_name,  tname);
+	       program_name, temp_name);
 
       maybequit ();
     }
@@ -344,16 +343,30 @@ ar_save (void)
     }
   else
     {
-      char *ofilename = xstrdup (bfd_get_filename (obfd));
+      struct stat target_stat;
 
       if (deterministic > 0)
         obfd->flags |= BFD_DETERMINISTIC_OUTPUT;
 
       bfd_close (obfd);
 
-      smart_rename (ofilename, real_name, NULL);
+      if (stat (real_name, &target_stat) != 0)
+	{
+	  /* The temp file created in ar_open has mode 0600 as per mkstemp.
+	     Create the real empty output file here so smart_rename will
+	     update the mode according to the process umask.  */
+	  obfd = bfd_openw (real_name, NULL);
+	  if (obfd != NULL)
+	    {
+	      bfd_set_format (obfd, bfd_archive);
+	      bfd_close (obfd);
+	    }
+	}
+
+      smart_rename (temp_name, real_name, NULL);
       obfd = 0;
-      free (ofilename);
+      free (temp_name);
+      free (real_name);
     }
 }
 
diff --git a/binutils/objcopy.c b/binutils/objcopy.c
index 07a872b5a80..73aa8bc2514 100644
--- a/binutils/objcopy.c
+++ b/binutils/objcopy.c
@@ -20,7 +20,6 @@
 
 #include "sysdep.h"
 #include "bfd.h"
-#include "libbfd.h"
 #include "progress.h"
 #include "getopt.h"
 #include "libiberty.h"
diff --git a/binutils/rename.c b/binutils/rename.c
index f471b45fd3f..2ff092ee22b 100644
--- a/binutils/rename.c
+++ b/binutils/rename.c
@@ -130,11 +130,11 @@ int
 smart_rename (const char *from, const char *to,
 	      struct stat *target_stat ATTRIBUTE_UNUSED)
 {
-  bfd_boolean exists;
-  struct stat s;
   int ret = 0;
+  struct stat to_stat;
+  bfd_boolean exists;
 
-  exists = lstat (to, &s) == 0;
+  exists = lstat (to, &to_stat) == 0;
 
 #if defined (_WIN32) && !defined (__CYGWIN32__)
   /* Win32, unlike unix, will not erase `to' in `rename(from, to)' but
-- 
2.31.1